Recoverable, Tamper-resistant Full-disk Encryption at the Distributed Edge
summary
A practical, open-source framework that encrypts disks on TPM-equipped edge devices and adds automated recovery, monitoring and remote access; it uses Clevis with Tang for recovery, a custom PCL-predict Python PCR prediction script to reseal keys across kernel/initramfs updates, dracut modules to build a networked recovery initramfs, and WireGuard plus SSH and Prometheus for access and alerts. Grub required disabling secure boot for TPM modules; the system has been field-tested on heterogeneous Ubuntu edge fleets and works with automated reseal and alerting.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 3:19The four security components
- 4:04Implementation details
- 22:56Summary of components
- 23:50Questions and answers
related talks
51mApplications of TPM 2.0
51mSecuring Embedded Linux Systems with TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
34mAuthenticated and Encrypted Storage on Embedded Linux
18mSecuring Edge Systems with TPM 2.0 and SPIRE
45mFull Disk Encryption for Confidential Computing Guests
25mTPM 2.0 Attestable Firmware: Recovering Trust After Firmware Flaws
01h 18mSystemd & TPMs